From a75fb7b198eed50d769c80c36629f38346882cbf Mon Sep 17 00:00:00 2001
From: Paul Mackerras <paulus@ozlabs.org>
Date: Thu, 4 Aug 2022 12:23:08 +1000
Subject: [PATCH] pppdump: Avoid out-of-range access to packet buffer

This fixes a potential vulnerability where data is written to spkt.buf
and rpkt.buf without a check on the array index.  To fix this, we
check the array index (pkt->cnt) before storing the byte or
incrementing the count.  This also means we no longer have a potential
signed integer overflow on the increment of pkt->cnt.

Fortunately, pppdump is not used in the normal process of setting up a
PPP connection, is not installed setuid-root, and is not invoked
automatically in any scenario that I am aware of.

Signed-off-by: Paul Mackerras <paulus@ozlabs.org>

Upstream-Status: Backport
Signed-off-by: Ross Burton <ross.burton@arm.com>
---
 pppdump/pppdump.c | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/pppdump/pppdump.c b/pppdump/pppdump.c
index 2b815fc9..b85a8627 100644
--- a/pppdump/pppdump.c
+++ b/pppdump/pppdump.c
@@ -297,6 +297,10 @@ dumpppp(f)
 			    printf("%s aborted packet:\n     ", dir);
 			    q = "    ";
 			}
+			if (pkt->cnt >= sizeof(pkt->buf)) {
+			    printf("%s over-long packet truncated:\n     ", dir);
+			    q = "    ";
+			}
 			nb = pkt->cnt;
 			p = pkt->buf;
 			pkt->cnt = 0;
@@ -400,7 +404,8 @@ dumpppp(f)
 			c ^= 0x20;
 			pkt->esc = 0;
 		    }
-		    pkt->buf[pkt->cnt++] = c;
+		    if (pkt->cnt < sizeof(pkt->buf))
+			pkt->buf[pkt->cnt++] = c;
 		    break;
 		}
 	    }